CVE-2026-127088

Description

2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging the HTTP Host header. Attackers can request password or WebAuthn recovery emails with an attacker-controlled host, capture the victim's token, and take over accounts exposing stored TOTP/HOTP secrets.

References

• https://github.com/Bubka/2FAuth/blob/v9.0.0/app/Http/Kernel.php#L47
• https://github.com/Bubka/2FAuth/blob/v9.0.0/app/Notifications/WebauthnRecoveryNotification.php#L62-L64
• https://github.com/Bubka/2FAuth/commit/35ce085b69f9f5044dfb94017c3f27c1dc2668f3
• https://github.com/Bubka/2FAuth/releases/tag/v9.0.1
• https://github.com/Bubka/2FAuth/security/advisories/GHSA-v9qw-r94g-95qv